How to secure your Ubuntu 24.04 Server from Malware

Ubuntu servers are widely used due to their stability and open-source nature, but like any system, they can be vulnerable to malware and attacks if not properly secured. In this guide, we will cover effective practices to protect your Ubuntu server from malware and other security threats, helping you build a strong defense for your server environment.

We will start by some programs and then we will mention some good practices to protect your server

ClamAV is a widely used open-source antivirus engine designed for detecting a variety of malicious software, including viruses, trojans, and malware. It is highly regarded for its flexibility and effectiveness, making it a popular choice for security-conscious users. ClamAV is available across multiple platforms, with native support in most Linux distributions, making it a go-to solution for server and desktop protection in the Linux ecosystem.

Install it with following command:

ClamAV relies on a database of virus definitions to detect threats. After installation, it’s important to update the virus definitions to ensure ClamAV is equipped to detect the latest threats.

Stop the ClamAV service to ensure it doesn't interfere with the update:

Manually update the virus definitions using the freshclam tool:

Start the ClamAV service again:

ClamAV will now run in the background and keep your virus definitions up to date.

After installation and updating, you can start scanning your system for potential threats.

The -r flag tells ClamAV to scan recursively through directories.

Scan a Specific File: To scan a single file, use:

Automating Virus Database Updates, to ensure ClamAV stays up to date, you can configure it to automatically update its virus definitions.

Verify that freshclam is running as a service: ClamAV automatically installs the freshclam service, which periodically updates the virus database. You can check its status using:

If the service isn’t running or you want to ensure it starts on boot, you can enable it:

This completes the installation and setup of ClamAV on your Linux system. It will now scan for threats and update its virus definitions automatically to ensure ongoing protection.

Chkrootkit is a free, open-source tool designed to check for rootkits on Unix-based systems, including Linux. Rootkits are malicious software that hide on your system, often giving attackers privileged access. Chkrootkit helps detect such intrusions by scanning your system for signs of compromise.

Install Chkrootkit

Install Chkrootkit by running the following command:

Running Chkrootkit for Rootkit Detection. After installation, you can immediately start using Chkrootkit to scan your system for potential rootkits.

This command will start a series of checks for known rootkits on your system. Chkrootkit scans various system binaries and files for any modifications or suspicious activity.

Interpret the output: The tool will produce output indicating if any potential rootkits are found. For example, if no rootkits are detected, you'll see lines such as:

If Chkrootkit finds something suspicious, it will notify you with messages like:

Running Detailed Checks with Options

List available tests: To see all the checks that Chkrootkit performs, use:

Check specific directory or binary: To check a particular directory or binary for rootkits:

Run Chkrootkit in expert mode: If you want to see detailed output, use the -x option:

Best practices to secure your ubuntu server

Regularly updating your server ensures that you have the latest security patches and bug fixes. Outdated packages are a major source of vulnerabilities.

To automatically apply security updates, install the unattended-upgrades package:

Then enable automatic updates:

A firewall is essential for controlling incoming and outgoing network traffic and protecting your server from unauthorized access. Ubuntu comes with UFW, a simple interface for managing iptables. To enable UFW and set up basic rules:

You can also allow or deny specific ports:

Check the status of UFW:

An IDS monitors your system for suspicious behavior and alerts you when it detects any potential threats.

AIDE (Advanced Intrusion Detection Environment) is a file and directory integrity checker.

To install:

Initialize the database:

After initialization, run regular checks:

Encrypting your disk adds an extra layer of security, especially if the server is physically compromised.

Encrypt Specific Directories, ou can encrypt sensitive directories, such as /home, using tools like ecryptfs-utils.

Securing your Ubuntu server requires ongoing efforts, from installing essential tools like antivirus software and firewalls to implementing advanced practices like SSH hardening and intrusion detection. Following these guidelines will help you build a resilient, secure environment, reducing the risk of malware and unauthorized access. Regular monitoring and updates will further strengthen your defenses.